QingdaoU/Judger
1
0
Fork 0
mirror of https://github.com/QingdaoU/Judger.git synced 2024-12-28 07:51:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

add openat seccomp rule

Browse Source
This commit is contained in:
zema1 2017-08-29 19:08:28 +08:00
parent 679994e8df
commit 850040e21d
4 changed files with 85 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/rules/general.c
View File

@ -27,13 +27,21 @@ int general_seccomp_rules(struct config *_config) {
if (seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(execve), 1, SCMP_A0(SCMP_CMP_NE, (scmp_datum_t)(_config->exe_path))) != 0) {
return LOAD_SECCOMP_FAILED;
}
// do not allow "w" and "rw"
// do not allow "w" and "rw" using open
if (seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(open), 1, SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) != 0) {
return LOAD_SECCOMP_FAILED;
}
if (seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(open), 1, SCMP_CMP(1, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) != 0) {
return LOAD_SECCOMP_FAILED;
}
// do not allow "w" and "rw" using openat
if (seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(openat), 1, SCMP_CMP(2, SCMP_CMP_MASKED_EQ, O_WRONLY, O_WRONLY)) != 0) {
return LOAD_SECCOMP_FAILED;
}
if (seccomp_rule_add(ctx, SCMP_ACT_KILL, SCMP_SYS(openat), 1, SCMP_CMP(2, SCMP_CMP_MASKED_EQ, O_RDWR, O_RDWR)) != 0) {
return LOAD_SECCOMP_FAILED;
}
if (seccomp_load(ctx) != 0) {
return LOAD_SECCOMP_FAILED;
}

55
tests/Python_and_core/testcase/seccomp/test.py
View File

@ -58,9 +58,9 @@ class SeccompTest(base.BaseTestCase):
self.assertEqual(result["result"], _judger.RESULT_RUNTIME_ERROR)
self.assertEqual(result["signal"], self.BAD_SYSTEM_CALL)
def test_write_file(self):
def test_write_file_using_open(self):
config = self.base_config
config["exe_path"] = self._compile_c("write_file.c")
config["exe_path"] = self._compile_c("write_file_open.c")
config["output_path"] = config["error_path"] = self.output_path()
path = os.path.join(self.workspace, "file1.txt")
config["args"] = [path, "w"]
@ -81,14 +81,59 @@ class SeccompTest(base.BaseTestCase):
self.assertEqual(result["result"], _judger.RESULT_RUNTIME_ERROR)
self.assertEqual(result["signal"], self.BAD_SYSTEM_CALL)
def test_read_write_file(self):
def test_read_write_file_using_open(self):
config = self.base_config
config["exe_path"] = self._compile_c("write_file.c")
config["exe_path"] = self._compile_c("write_file_open.c")
config["output_path"] = config["error_path"] = self.output_path()
path = os.path.join(self.workspace, "file2.txt")
config["args"] = [path, "w+"]
result = _judger.run(**config)
print(result)
# without seccomp
self.assertEqual(result["result"], _judger.RESULT_SUCCESS)
self.assertEqual("", self.output_content(path))
# with general seccomp
config["seccomp_rule_name"] = "general"
result = _judger.run(**config)
self.assertEqual(result["result"], _judger.RESULT_RUNTIME_ERROR)
self.assertEqual(result["signal"], self.BAD_SYSTEM_CALL)
# with c_cpp seccomp
config["seccomp_rule_name"] = "c_cpp"
result = _judger.run(**config)
self.assertEqual(result["result"], _judger.RESULT_RUNTIME_ERROR)
self.assertEqual(result["signal"], self.BAD_SYSTEM_CALL)
def test_write_file_using_openat(self):
config = self.base_config
config["exe_path"] = self._compile_c("write_file_openat.c")
config["output_path"] = config["error_path"] = self.output_path()
path = os.path.join(self.workspace, "file3.txt")
config["args"] = [self.workspace, "file3.txt", "w"]
result = _judger.run(**config)
# without seccomp
self.assertEqual(result["result"], _judger.RESULT_SUCCESS)
self.assertEqual("", self.output_content(path))
# with general seccomp
config["seccomp_rule_name"] = "general"
result = _judger.run(**config)
self.assertEqual(result["result"], _judger.RESULT_RUNTIME_ERROR)
self.assertEqual(result["signal"], self.BAD_SYSTEM_CALL)
# with c_cpp seccomp
config["seccomp_rule_name"] = "c_cpp"
result = _judger.run(**config)
self.assertEqual(result["result"], _judger.RESULT_RUNTIME_ERROR)
self.assertEqual(result["signal"], self.BAD_SYSTEM_CALL)
def test_read_write_file_using_openat(self):
config = self.base_config
config["exe_path"] = self._compile_c("write_file_openat.c")
config["output_path"] = config["error_path"] = self.output_path()
path = os.path.join(self.workspace, "file4.txt")
config["args"] = [self.workspace, "file4.txt", "w+"]
result = _judger.run(**config)
# without seccomp
self.assertEqual(result["result"], _judger.RESULT_SUCCESS)
self.assertEqual("", self.output_content(path))

0
tests/test_src/seccomp/write_file.c → tests/test_src/seccomp/write_file_open.c
View File

26
tests/test_src/seccomp/write_file_openat.c Normal file
View File

@ -0,0 +1,26 @@
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <dirent.h>
#include <sys/types.h>
#include <unistd.h>
#include <sys/stat.h>
int main(int argc, char *argv[]) {
DIR *dir = opendir(argv[1]);
int dir_fd = dirfd(dir);
int flags;
if (!strcmp(argv[3], "w")) {
flags = O_WRONLY | O_CREAT;
}
else {
flags = O_RDWR | O_CREAT;
}
int fd = openat(dir_fd, argv[2], flags, 0755);
if (fd < 0) {
return errno;
}
close(fd);
return 0;
}